Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [encoding]

Encoding is a set of predefined rules to reversibly transform a piece of information in a certain representation into a completely different representation. The other way round is called decoding.

-2
votes
1answer
63 views

how to decode this request [closed]

I need help for this. I got a request but I don't know what can I do: GET http://localhost/xor.php?plaintext=cipher=%00%00%1D%10%1A,%06%05%16%16%0D%12%0B%3A9%5DRT%06YVD HTTP/1.1 Full request : https:...
1
vote
0answers
57 views

Problem with Reverse Engineering GVM light, possibly encoding issue

So I bought this GVM-560AS LED photography light on Amazon. It is a really good light for the job; but to control it remotely you have to download a really dodgy APK from the GVM website, a package ...
0
votes
3answers
125 views

What string encoding options are there besides xor? [closed]

When attempting to obfuscate strings in a modern program, xor is probably the most common option. By this I mean running each char of a string through a function which xors the char with some given ...
0
votes
1answer
89 views

Metasploit encoders

Can someone explain to me how can I use this encoder encoder/x86/bmp_polyglot? Via msfvenom its not possible because it doesn't give the possibility to set the encoder options (BitmapFile). For ...
1
vote
0answers
42 views

rar and zip password encoding scheme [closed]

What encoding scheme is used in last versions of ZIP archives(6.3.2+) and RAR archives(3.90+), including RAR5? UTF-8/16, ASCII or something else?
-1
votes
1answer
110 views

What's the purpose of Base64 if knowing its Base64 makes it easy to decode

The title I think gets the point across. Lets focus solely on these hypothetical situations: Basic Auth headers when making API calls with user:pass Storing passwords in an SQL database What makes ...
1
vote
0answers
44 views

What exactly is URL-safe Base 64 encoding? [closed]

And how is it different form the normal Base 64 encoding?
1
vote
1answer
53 views

Encoding ASCII character as three-byte UTF-8. How does it work?

I'm reading a report on HackerOne https://hackerone.com/reports/52042. An input filter was bypassed by sending %E5%98%8A that was then parsed as 0x0A character (new line). The %E5%98%8A sequence ...
1
vote
0answers
48 views

Help needed in identifying a string [closed]

I need help in identifying the following string in order to decode it to a piece of meaningful information. h_t_s_/_g_s_._k_l_b_c_m_4_9_a_k_6_f_8_4_8_e_e_r_9_3_9_f_
3
votes
3answers
130 views

Encoding output in JSON HTTP API

I'm the author of a JSON REST API. This REST API is consumed by various clients, such as HTML/JS-clients, .NET clients (console applications) and Ruby clients. The output of the API is in JSON format, ...
2
votes
3answers
90 views

Is it risky to URL-encode characters in an already URL-encoded string?

I'm maintaining a legacy web application which is composed of the application itself, accessible to the public, and the REST services which can be accessed only by the application through the LAN. At ...
0
votes
2answers
71 views

is encoding the same as encryption for malware obfuscation?

I have been learning about hiding and executing msfvenom created shellcode and came to a technique where we xor the shellcode and when executing we reverse it.Would it be the same if i just encrypt it ...
0
votes
3answers
226 views

Why doesn't XSS execute when bypassing HTML encoding?

I am trying to execute an XSS payload on a search field that takes my input like this: <input name="q" id="gsasearch" type="text" value="My Input"></input> Observations: <, > and "...
1
vote
0answers
103 views

Help figuring out this hash function [closed]

I have a tough nut to crack. I'm working on hashing passwords for our network switches (because the alternative is plain-text passwords...). For people who would care about this; it's a huawei switch. ...
0
votes
1answer
84 views

Odd characters — including a backslash — in magstripe track 1 name field?

I've been in the Point of Sale industry for decades. Parsing card magnetic stripe track 1 data has never been difficult, but lately we've started to see some odd data in the name field of cards that ...
0
votes
1answer
33 views

Problem identifying this encoding schematic into plain text

Im really new to all of this i'd like some insight. the encoding scheme looks like this e0b7 e51f a24f 2ee8 f950 ecc4 d46b 6b3b 11bd 1930 ccb0 3c9f ecf5 368d f570 c72d a37e 47a6 bf03 2cf4 947c e913 ...
0
votes
2answers
2k views

XSS with URL encoding

If a website URL gets encoded then is the website still vulnerable to XSS or no? For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
3
votes
2answers
449 views

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context?

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context? I have a website that displays the URL path directly in HTML context, i.e....
3
votes
1answer
108 views

Exploit user input being directly inserted into PDF

I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded. The user input is accepted as is, without encoding or any other modification. This ...
0
votes
1answer
150 views

Is a substring of base64 encoded random_bytes less secure then just using random_bytes

$bytes = random_bytes(15); $encoded = base64_encode($bytes); $output = substr($encoded, 0, 15); Does this code affect the complexity of the output vs just using $output = random_bytes(15); I think ...
1
vote
1answer
365 views

ASN.1 encoding of X25519 private key

I'm using mbed TLS for ECDH key agreement using Curve25519. The private and public keys are stored and transmitted as Hex strings as easily generated with mbed TLS. Those strings are big-endian. This ...
0
votes
1answer
51 views

SQL Query Sanatization

It seems to me SQL injection could be avoided by just converting everything to a simple encoding like base64 that doesn't have any harmful symbols. In the classic query "SELECT * FROM users WHERE ...
1
vote
0answers
60 views

Server improperly handling unicode characters?

So I'm pen-testing a web application. Upon submitting certain data it sends it in a POST request which contains the data in a JSON object. So while fuzzing it I was testing for improper encoding ...
4
votes
1answer
277 views

Hydra - Attacking when login page encodes the username and password

I needed to test how Hydra works, so I tried to attack my own wifi router. I set the user name as "user" and created a txt file containing 100 passwords including the "real" password. I am unable to ...
0
votes
0answers
28 views

Is there a way to detect the encoding algorithm of a string? [duplicate]

I need something like hash-identifier tool, but for encoding schemes. Is there a similar tool out there?
2
votes
0answers
325 views

Security risks with pdf files in object tag at client/server side

This is my situation: a user uploads a pdf file to my server. The data travels encoded in base64 (like a regular input in a form). The base64 is saved in one particular file on my server. Now, another ...
0
votes
0answers
321 views

Single and double URL encoding tamper scripts and sqlmap

I am trying to understand how sqlmap tamper scripts work, and when each one of them is able to bypass certain custom filters. In the following code after the POST parameter is filtered for strings ...
23
votes
1answer
4k views

When and why does bypassing XSS sanitizers with double encoding work?

I have read in different sites about different ways to bypass XSS sanitizers, like double encoding special characters such as /<>:"', or employing different encoding schemes. However most of ...
0
votes
2answers
491 views

Is it safe to get html encoded data from database to prevent stored XSS attack?

for security purpose now i'm fetching all data from database with htmlEncoded format. it is correct? please help..
1
vote
0answers
69 views

Exploiting XSS when attack vector is passed in Javascript context after being HTML encoded?

My attack vector is being passed in three contexts. HTML element: <p>injection</p> HTML attribute value: <input value="injection"> Javascript: <script> var a = "...
0
votes
0answers
622 views

Should Content-Encoding deflate be disabled [duplicate]

After scaning web page with Nikto I have results that is "The Content-Encoding header is set to "deflate" this may mean that the server is vulnerable to the BREACH attack." How to verify if that ...
4
votes
1answer
509 views

Why context sensitive encoding to prevent XSS?

OWASP recommends that context-sensitive encoding needs to be done. Please help me in getting a couple of strong "code examples" on why context sensitive based encoding needs to be done and why HTML ...
8
votes
3answers
2k views

How is character encodings used to bypass XSS sanitizers?

I read in different blogs that PHP htmlspecialchars() function has certain problems when one does not give the expected charset as an optional parameter. Can someone explain some basic stuff about ...
2
votes
1answer
76 views

Decoding requests from potentially malicious Android app

I have recently been doing some security evaluation work on our Android applications, by proxying all the communication through Burp Suite. I noticed one of our devices was sending requests to a ...
2
votes
1answer
101 views

Does the ECDSA signature value (of an OCSP response) need to be DER encoded

In OCSP responses by a certain eIDAS PKI I every once in a while get signature values which, when unpacked from their BIT STRING, contain an ECDSA signature whose INTEGER constituents have an ...
0
votes
1answer
286 views

Is it possible to “encode” a bash sentence?

I was recently solving a CTF challenge that I found quite strange, first of all I have been given a chain of characters that no matter how hard I try to find an answer I can not find it, I am going to ...
0
votes
2answers
198 views

Would using a QWERTY keyboard with DVORAK output cause keylogger to log DVORAK?

I have QWERT keyboard, but I have set the keyboard settings in Windows to DVORAK. So if I type "test" it comes out as "y.oy". Would the key logger log "test" or "y.oy" in its records?
2
votes
1answer
633 views

AngularJS Sanitize function vs. server-side output encoding

I mainly audit web applications and provide the companies with security countermeasures and recommendations. Currently, I have an issue with giving a correct recommendation when it comes to AngularJS ...
4
votes
1answer
2k views

Bypassing browsers URL encoding to do reflected XSS from query parameter?

I tried to get reflected XSS in vulnerable website with a request to the following URL: https://vulnerable.website/dir/dir?param1=test"><svg/onload=alert(1)> The browser URL encode the ...
2
votes
3answers
120 views

What are some potential attacks that could be done to a website that doesn't manage url-encoding properly?

A month or so ago I was in the middle of one of my "Distributed Applications" classes and the professor was explaining us how to """properly""" authenticate users in a server. To demonstrate how to ...
2
votes
1answer
248 views

Phishing email with encoded url params

I received a phishing email with the following format: hxxp://<%legitimateSite%>/~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%23$%25%5e&*()+~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%...
0
votes
2answers
215 views

padding problem in sha-1 hashed password

For my own understanding of Websphere LTPA keys, I'm running this Java code, which works correctly when using the author's Base64 encoded, SHA1 hashed password: String ltpa3DESKey = "...
0
votes
1answer
626 views

Explanation of illegal multi-byte encoding leading to XSS

I'm reading this report on unicode security and found the following paragraphs confusing: When converting from a multi-byte encoding, a byte value may not be a valid trailing byte, in a context ...
0
votes
1answer
165 views

What type of encoded text is this and how can I translate it? [duplicate]

I have no experience, but I've been playing a game and it's rather interesting. One of the character files has a long line of scrambled text and I was wondering if someone could tell me if it's ...
1
vote
0answers
96 views

Are JSON key names vulnerable to alternate encoding (CAPEC-267) attacks?

It's sometimes possible to use an alternate encoding to get around security checks (CAPEC-267). While the JSON spec may be strict on what is valid, popular parsers don't necessarily conform perfectly [...
1
vote
1answer
722 views

Does storing Base64 encoding of scrypt password hash make it more vulnerable?

Scrypt produces a binary hash of a password. Instead of storing it as bytes directly, we are considering to store the Base64 encoding of this string. Would that make the password hash more vulnerable ...
1
vote
0answers
428 views

prevent CRLF Injection using encoding

I read in a lot of articles including this and this one that we should always use a function to encode the CR and LF special characters to prevent CRLF Injection, but AFAIK to perform this attack ...
2
votes
2answers
242 views

why is it insecure to use userdata in url parameter names?

On the OWASP site on XSS it says that it is safe to put userdata in GET parameter values when encoded. However, userdata should not be used anywhere else, so not in the scheme, the domain or ...
0
votes
1answer
216 views

Mov byte to addres inside a register

I am trying to write a shell insertion decoder (my encoder works as expected). But when I try to move one byte to the address inside a register i face a Segmentation fault. The error happens in this ...
4
votes
1answer
1k views

Function of %5c.. in a path traversal

I've recently come across this blog post of a bug bounty hunter. Apparently, a path traversal vulnerability was discovered, which looked like this: http://help.example.com/@app/skin/views/%5c../%5c....